The Heartbleed Bug

Post by personjerry » Mon, Apr 07, 2014, 9:38 PM UTC

phillmv wrote: post #51

Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin. Suggestion: big, bold TLDR ("The sky is falling. Check your OpenSSL version right now") with a link on what to do sorted by OS vendor. Step 1: Here's a command to spit out your OpenSSL version. If it is the following string, go to step 2. Step 2: Here's how to update your OpenSSL. Here are links to guides on reissuing…

Post by MagerValp » Mon, Apr 07, 2014, 9:40 PM UTC

[deleted] wrote: post #53

Dorian-Marie wrote: post #8

Earlier quoted context omitted.

Not affected directly on Mac OS: OpenSSL 0.9.8y 5 Feb 2013

[deleted]

    $ sw_vers
    ProductName:	Mac OS X
    ProductVersion:	10.9.2
    BuildVersion:	13C64
    $ openssl version
    OpenSSL 0.9.8y 5 Feb 2013

Post by makomk » Mon, Apr 07, 2014, 9:41 PM UTC

jabo wrote: post #62

MartinMond wrote: post #20

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

I just did a apt-get update and apt-get upgrade and I saw upgrades for openssh-client and openssh-server.

Post by mappu » Mon, Apr 07, 2014, 9:42 PM UTC

MartinMond wrote: post #20

As of now (21:04 UTC) this isn't fixed in Debian https://security-tracker.debian.org/tracker/CVE-2014-0160 nor Ubuntu http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... Got a long night ahead :/

Post by this_user » Mon, Apr 07, 2014, 9:45 PM UTC

ams6110 wrote: post #48

oskarth wrote: post #39

This thing has been in the wild for two years. What are the odds it hasn't been systematically abused? And what does this imply? To me it sounds kind of like finding out the fence in your backyard was cut open two years ago. Except in this case the backyard is two thirds of the internet.

Worse, it's retroactively unfixable: Even doing all this [revoking certs, new secret keys, new certificates] will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. So it would be a good idea to change all your passwords to critical services like email and banks, once they have issued new certs and updated their openssl.